Blockchain-based personnel configuration information security storage method and system, and medium

Abstract

The application discloses a personnel configuration information security storage method and system based on a blockchain, relates to the technical field of blockchain storage, and comprises the following steps: constructing a personnel configuration graph, using an encrypted public key of an employee, and storing the personnel configuration graph into a personnel configuration blockchain; dividing the employee into K employee clustering clusters; setting a minimum data access permission set for each employee clustering cluster according to a historical access data subset of the employee contained in the employee clustering cluster; searching for an employee clustering cluster in which an inquiring employee is located as a target clustering cluster; receiving a knowledge graph query statement input by the inquiring employee; obtaining corresponding query data from the personnel configuration blockchain; and using a decryption private key corresponding to the inquiring employee to decrypt the query data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain storage, in particular to a personnel configuration information security storage method and system based on blockchain and a medium. BACKGROUND

[0002] The current enterprise personnel configuration information management is facing severe data security and privacy protection challenges. Traditional personnel configuration information systems mostly use centralized storage. Once the system is invaded or internal data leakage occurs, sensitive information such as salary and performance evaluation is easily stolen and misused, which brings huge privacy and economic risks to enterprises and employees. In addition, static access control strategy cannot fully meet the data access needs of different employee roles, resulting in too coarse or too fine data access granularity, affecting work efficiency.

[0003] A human resource platform talent data information security management system based on blockchain is disclosed in Chinese patent CN115936630B, which takes job seekers, enterprise users and the relationship between job seekers and enterprise users as management objects, and divides the talent data security management on the human resource platform into resume creation and publishing security management, enterprise user recruitment qualification audit management and resume operation security management. However, this method cannot solve the problem of dynamic control of employee access permissions.

[0004] Therefore, the present application proposes a personnel configuration information security storage method, system and medium based on blockchain. SUMMARY

[0005] The present application aims to at least solve one of the technical problems existing in the prior art. To this end, the present application proposes a personnel configuration information security storage method, system and medium based on blockchain, which effectively protects the privacy and security of employee personal data.

[0006] To achieve the above-mentioned purpose, a personnel configuration information security storage method based on blockchain is proposed, which comprises the following steps:

[0007] Step 1: Collect personnel configuration data and build a personnel configuration graph based on the personnel configuration data;

[0008] Step 2: Generate an encryption public key and a decryption private key for each employee; divide the personnel configuration graph into sensitive information and non-sensitive information, and based on the sensitive information and non-sensitive information, use the employee's encryption public key to encrypt the personnel configuration graph and store it in the personnel configuration blockchain;

[0009] Step 3: Collect employee historical access data, use clustering algorithm based on the personnel configuration graph to divide employees into K employee clustering clusters; K is the number of preset employee clustering clusters;

[0010] Step four: setting a minimum data access permission set for each employee cluster according to the historical access data subset contained in the employee cluster of each employee;

[0011] Step five: collecting the identity information of each inquiring employee, and based on the identity information, retrieving the employee cluster in which the inquiring employee is located as a target cluster;

[0012] Step six: receiving the knowledge graph query statement input by the inquiring employee, and based on the minimum data access permission set of the target cluster and the knowledge graph query statement, obtaining corresponding query data from the personnel configuration blockchain, and decrypting the query data using the decryption private key corresponding to the inquiring employee;

[0013] The collection of personnel configuration data is performed in the following manner:

[0014] The existing personnel configuration data of each type of personnel configuration data is collected from the personnel configuration information system, and each item of personnel configuration data is preprocessed to obtain structured personnel configuration data;

[0015] The construction of the personnel configuration graph based on the personnel configuration data includes the following steps:

[0016] Step 11: constructing a graph ontology of the personnel configuration graph;

[0017] Step 12: using an entity extraction model to extract a concept entity set of each core concept in the graph ontology, using a relationship extraction model to extract a relationship entity set of each relationship type in the graph ontology, and using an attribute extraction model to extract an attribute set entity set of each concept entity and relationship entity in the graph ontology;

[0018] Step 13: according to the concept entity set, the relationship entity set, and the attribute set entity set, describing the concept entity, the relationship entity, and the attribute set using a knowledge graph representation language, and establishing a link between each concept entity and relationship entity, to form a unified personnel configuration knowledge graph;

[0019] The manner of dividing the personnel configuration graph into sensitive information and non-sensitive information is as follows:

[0020] According to the data security policy of the enterprise, determine the personnel configuration data type belonging to the sensitive level as the sensitive type;

[0021] From the graph ontology, filter out the data belonging to the sensitive type in each entity type and attribute set as the sensitive information ontology;

[0022] In the personnel configuration graph, the concept entities and attribute set entities corresponding to the sensitive information ontology are marked as sensitive information, and the remaining concept entities, relationship entity sets and attribute set entity sets in the personnel configuration graph except the sensitive information are marked as non-sensitive information.

[0023] The method for encrypting the personnel configuration graph into the personnel configuration blockchain using the encrypted public key of the employee based on the sensitive information and the non-sensitive information is:

[0024] Traverse all concept entity sets, relationship entity sets and attribute set entity sets of the personnel configuration graph:

[0025] For sensitive information:

[0026] Read the corresponding employee's encrypted public key and use the encrypted public key and the corresponding asymmetric encryption algorithm to encrypt the sensitive information;

[0027] Create a new data block on the personnel configuration blockchain, and store the encrypted sensitive information ciphertext and the plaintext form of the non-sensitive data in the new data block;

[0028] Organize the employee's data storage area through linkage for each employee, store the employee's personnel configuration data type in different blockchain branches, create a storage mapping index for each employee, and record the location of the employee's corresponding data in the blockchain;

[0029] The method for collecting employee historical access data and dividing employees into K employee clustering clusters based on the personnel configuration graph using a clustering algorithm includes the following steps:

[0030] Step 21: Collect employee historical access data by tracking and recording the access operation of each employee to the personnel configuration graph;

[0031] Step 22: Based on the employee historical access data and the personnel configuration graph, an employee access matrix is constructed; including:

[0032] Obtain the list of all concept entities, relationship entities and attribute set entities from the personnel configuration graph as the columns of the employee access matrix;

[0033] Obtain the list of all employee IDs from the employee historical access data as the rows of the employee access matrix;

[0034] The element value of each row and column of the employee access matrix is initially set to 0;

[0035] Traverse the employee historical access data, set the element value corresponding to the concept entity, relationship entity and attribute set entity accessed by each employee ID to 1, and finally build a 0 / 1 employee access matrix of M rows and N columns to describe the access relationship between employees and entities; M is the number of employee IDs, and N is the total number of concept entities, relationship entities and attribute set entities;

[0036] Step 24: Randomly initialize K cluster centers using the K-Means++ algorithm;

[0037] Step 25: Traverse each employee of the employee access matrix, calculate the distance between the employee and each cluster center, and divide the employee into the employee cluster corresponding to the nearest cluster center, and recalculate the position of the center point of each cluster;

[0038] Step 26: Continue to repeat step 25 until the employee IDs contained in each cluster center corresponding employee cluster no longer change;

[0039] The way of setting the minimum data access permission set for each employee cluster according to the employee historical access data subset contained in each employee cluster is:

[0040] For each employee cluster, count the concept entities, relationship entities and attribute set entities accessed by all employees in the employee cluster to form the minimum data access permission set;

[0041] The way of receiving the knowledge graph query statement input by the inquiring employee, obtaining the corresponding encrypted data from the personnel configuration blockchain based on the minimum data access permission set of the target cluster and the knowledge graph query statement, and decrypting the encrypted data using the decryption private key corresponding to the inquiring employee is:

[0042] Retrieve the concept entity, relationship entity or attribute set entity that needs to be queried from the knowledge graph query statement as a query target;

[0043] Query whether the query target is contained in the minimum data access permission set of the target cluster, and if not, reject the query;

[0044] If the query target is contained, read the target content corresponding to the query target from the corresponding storage location according to the storage location of the query target on the personnel configuration blockchain, and use the decryption private key of the inquiring employee to decrypt the sensitive information ciphertext in the target content.

[0045]

[0046] ​The personnel configuration information security storage system based on a blockchain is provided, comprising a personnel configuration graph construction module, a personnel configuration blockchain construction module, an employee clustering cluster construction module and a secure access module; wherein the modules are connected through electrical connection;

[0047] The personnel configuration graph construction module collects personnel configuration data, constructs a personnel configuration graph based on the personnel configuration data, and sends the personnel configuration graph to the personnel configuration blockchain construction module, the personnel configuration blockchain construction module and the secure access module;

[0048] The personnel configuration blockchain construction module generates an encryption public key and a decryption private key for each employee, divides sensitive information and non-sensitive information of the personnel configuration graph, encrypts the personnel configuration graph into the personnel configuration blockchain based on the sensitive information and the non-sensitive information using the encryption public key of the employee, and sends the personnel configuration blockchain to the secure access module;

[0049] The employee clustering cluster construction module collects employee historical access data, divides the employees into K employee clustering clusters based on the personnel configuration graph using a clustering algorithm, and sends the employee clustering clusters to the secure access module;

[0050] The secure access module sets a minimum data access permission set for each employee clustering cluster according to the employee historical access data subset contained in each employee clustering cluster, collects the identity information of each inquiring employee, retrieves the employee clustering cluster in which the inquiring employee is located as a target clustering cluster based on the identity information, receives a knowledge graph query statement input by the inquiring employee, obtains corresponding encrypted data from the personnel configuration blockchain based on the minimum data access permission set of the target clustering cluster and the knowledge graph query statement, and decrypts the encrypted data using the decryption private key corresponding to the inquiring employee.

[0051] A computer readable storage medium is provided, which stores an erasable computer program;

[0052] When the computer program runs on the computer device, the computer device executes the personnel configuration information security storage method based on a blockchain.

[0053] Compared with the prior art, the beneficial effects of the present application are:

[0054] This invention collects personnel configuration data and constructs a personnel configuration graph based on this data, generating an encryption public key and a decryption private key for each employee. The personnel configuration graph is then divided into sensitive and non-sensitive information categories. Based on these categories, and using the employee's encryption public key, the personnel configuration graph is encrypted and stored in a personnel configuration blockchain. Historical access data of employees is collected. Based on the personnel configuration graph, a clustering algorithm is used to divide employees into K employee clusters. A minimum data access permission set is set for each employee cluster based on the subset of historical access data contained within each cluster. The identity information of each employee being queried is collected. Based on this identity information, the employee cluster to which the queried employee belongs is retrieved as the target cluster. The system receives knowledge graph query statements input by employees, retrieves corresponding query data from the personnel configuration blockchain based on the minimum data access permission set for the target cluster and the knowledge graph query statement, and decrypts the query data using the decryption private key corresponding to the employee making the inquiry. Sensitive data is encrypted and stored on the blockchain, accessible only to the data owner holding the decryption private key, effectively preventing internal and external threats. Secondly, the distributed blockchain structure ensures the immutability and traceability of the data. Thirdly, the unified data representation based on the knowledge graph enhances the understandability and operability of the data. Finally, dynamic access control policies can accurately assign minimum permissions to different roles, improving work efficiency while protecting data security, thereby effectively protecting the privacy and security of employees' personal data. Attached Figure Description

[0055] Figure 1 This is a flowchart of the blockchain-based secure storage method for personnel configuration information in Embodiment 1 of the present invention;

[0056] Figure 2 This is a module connection diagram of the blockchain-based personnel configuration information security storage system in Embodiment 2 of the present invention;

[0057] Figure 3 This is a schematic diagram of the computer-readable storage medium structure in Embodiment 3 of the present invention. Detailed Implementation

[0058] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1

[0060] like Figure 1 As shown, a blockchain-based method for securely storing personnel configuration information includes the following steps:

[0061] Step 1: Collect personnel configuration data and construct a personnel configuration map based on the personnel configuration data;

[0062] Step 2: Generate an encryption public key and a decryption private key for each employee; divide the personnel configuration graph into sensitive and non-sensitive information; based on the sensitive and non-sensitive information, use the employee's encryption public key to encrypt and store the personnel configuration graph in the personnel configuration blockchain;

[0063] Step 3: Collect employee historical access data. Based on the personnel configuration map, use a clustering algorithm to divide the employee historical access data into K employee clusters; K is the preset number of employee clusters.

[0064] Step 4: Based on the subset of employee historical access data contained in each employee cluster, set a minimum set of data access permissions for each employee cluster;

[0065] Step 5: Collect the identity information of each employee being queried, and based on the identity information, retrieve the employee cluster to which the employee being queried belongs, and use it as the target cluster;

[0066] Step Six: Receive the knowledge graph query statement input by the employee making the inquiry. Based on the minimum data access permission set of the target cluster and the knowledge graph query statement, obtain the corresponding query data from the personnel configuration blockchain, and decrypt the query data using the decryption private key corresponding to the employee making the inquiry.

[0067] The method for collecting personnel configuration data is as follows:

[0068] Collect personnel configuration data of various existing personnel configuration data types from the personnel configuration information system, and perform data preprocessing on each personnel configuration data to obtain structured personnel configuration data;

[0069] Specifically, the personnel allocation information system includes, but is not limited to, financial systems, attendance systems, and internal human resources systems.

[0070] The personnel configuration data types include, but are not limited to, basic employee information (name, department, position, date of employment, etc.), salary and benefits information (base salary, performance bonus, social security and housing provident fund, etc.), attendance records (get off work hours, leave records, etc.), training records (training courses, time, grades, etc.), performance evaluation (KPI completion status, scores, comments, etc.), and employee relations (superiors, subordinates, colleagues, etc.).

[0071] The data preprocessing includes, but is not limited to, transforming unstructured data into structured data (e.g., using natural language processing technology to convert performance comments into rating levels), data cleaning, and standardization.

[0072] Furthermore, the construction of the personnel configuration map based on personnel configuration data includes the following steps:

[0073] Step 11: Construct the graph ontology of the personnel configuration graph, including:

[0074] Define the core concepts and entity types in the staffing domain, such as employees, departments, positions, performance, etc.

[0075] Determine the type of relationship between entities, such as employment relationship, management relationship, training relationship, etc.

[0076] Design attribute sets for entity types and relationship types, such as the name and age attributes for employee entities;

[0077] Construct a formal ontology model as the conceptual foundation for the personnel allocation knowledge graph;

[0078] Step 12: Use the entity extraction model to extract the set of concept entities of each core concept in the graph ontology, use the relation extraction model to extract the set of relation entities of each relation type in the graph ontology, and use the attribute extraction model to extract the set of attribute entities of each concept entity and relation entity in the graph ontology.

[0079] Specifically, the set of concept entities can be a NER model, and the relation extraction model can be any model of pipeline learning method or joint learning method, such as the CasRel model. The attribute extraction model is one of ReNoun, MetaPad, etc.

[0080] Step 13: Based on the set of concept entities, the set of relation entities, and the set of attribute entities, use a knowledge graph representation language to describe the concept entities, relation entities, and their attribute sets, and establish links between the various concept entities and relation entities to form a unified personnel configuration knowledge graph; the knowledge graph representation language can be RDF / OWL.

[0081] Furthermore, the method for generating an encryption public key and a decryption private key for each employee is as follows:

[0082] For each employee, a set of public and private keys for encryption using an asymmetric encryption algorithm are randomly generated to form an encryption key pair.

[0083] Specifically, the asymmetric encryption algorithms include, but are not limited to, RSA and ECC algorithms.

[0084] Furthermore, the method for dividing the personnel configuration map into sensitive and non-sensitive information is as follows:

[0085] Based on the company's data security policy, identify personnel configuration data types that fall under the sensitive level and designate them as sensitive types.

[0086] The sensitive information ontology is defined by filtering out data belonging to sensitive types in each entity type and attribute set from the graph ontology. For example, within an enterprise, salaries, performance evaluations, and personal identification information are typically considered sensitive information.

[0087] In the personnel configuration graph, the conceptual entities and attribute set entities corresponding to the sensitive information ontology are marked as sensitive information, while the remaining conceptual entities, relational entity sets, and attribute set entity sets in the personnel configuration graph are marked as non-sensitive information.

[0088] Furthermore, the method of encrypting and storing the personnel configuration graph in the personnel configuration blockchain using the employee's encrypted public key, based on sensitive and non-sensitive information, is as follows:

[0089] Traverse all sets of conceptual entities, relational entities, and attribute entities in the personnel configuration graph:

[0090] For sensitive information:

[0091] Read the corresponding employee's public key and use the public key and the corresponding asymmetric encryption algorithm to encrypt the sensitive information;

[0092] Create a new data block on the personnel configuration blockchain and store the encrypted sensitive information in ciphertext and the plaintext non-sensitive data in the new data block;

[0093] Each employee's data blocks are organized into a personal data storage area by linking them together. The employee's personnel configuration data type is stored in different blockchain branches. A storage mapping index is created for each employee to record the location of the corresponding data in the blockchain for easy subsequent querying.

[0094] Furthermore, the process of collecting employee historical access data and, based on the personnel configuration map, using a clustering algorithm to divide employees into K employee clusters includes the following steps:

[0095] Step 21: Collect employee historical access data by tracking and recording each employee's access operations to the personnel configuration graph; the employee historical access data includes, but is not limited to, employee ID, access time, accessed graph entities, attributes, and other information;

[0096] Step 22: Construct an employee access matrix based on employee historical access data and personnel configuration graph; including:

[0097] Obtain a list of all conceptual entities, relational entities, and attribute set entities from the personnel configuration graph, and use it as columns of the employee access matrix;

[0098] Obtain a list of all employee IDs from the employee's historical access data, and use it as rows in the employee access matrix;

[0099] The element values ​​of each row and column of the employee access matrix are initially set to 0;

[0100] Iterate through the employee's historical access data, set the element values ​​corresponding to the concept entity, relation entity, and attribute set entity accessed by each employee ID to 1, and finally construct an M-row N-column 0 / 1 employee access matrix to describe the access relationship between employees and entities; M is the number of employee IDs, and N is the total number of concept entities, relation entities, and attribute set entities.

[0101] Step 24: Randomly initialize K cluster centers using the K-Means++ algorithm;

[0102] Step 25: Traverse each employee in the employee visit matrix, calculate the distance between the employee and each cluster center, assign the employee to the employee cluster corresponding to the nearest cluster center, and recalculate the position of the center point of each cluster; specifically, the distance can be cosine similarity or Euclidean distance;

[0103] Step 26: Repeat step 25 until the employee IDs contained in the employee clusters corresponding to each cluster center no longer change;

[0104] Understandably, each employee cluster represents a group of employees with similar data access patterns. These groups share similar access habits. Therefore, a role type can be assigned to each employee cluster. For example, when analyzing the historical access data of employees within a certain cluster, it might be found that they have all accessed salary data, attendance data, and performance data, but not training data. Therefore, we can determine that the role corresponding to this employee cluster is "Personnel Allocation Specialist." Subsequently, access rights can be set for each role type based on this determined role.

[0105] Furthermore, the method for setting a minimum set of data access permissions for each employee cluster based on a subset of employee historical access data contained within each employee cluster is as follows:

[0106] For each employee cluster, count all concept entities, relation entities, and attribute set entities accessed by all employees within that cluster, forming a minimum data access permission set;

[0107] Understandably, by providing each employee with a role type, it is possible to precisely grant employees the minimum access permissions they need, which satisfies work requirements while reducing the risk of data breaches.

[0108] It is understood that the identity information of each employee being queried is the corresponding employee ID;

[0109] Furthermore, the method for receiving the knowledge graph query statement input by the employee, based on the minimum data access permission set of the target cluster and the knowledge graph query statement, to obtain the corresponding encrypted data from the personnel configuration blockchain, and to decrypt the encrypted data using the decryption private key corresponding to the employee is as follows:

[0110] The knowledge graph query statement can be a manually entered SQL query statement, or the information to be queried can be selected in the visual interface and converted into the corresponding SQL query statement by the system backend using computer language.

[0111] The query query statement is used to retrieve the concept entity, relation entity, or attribute set entity that needs to be queried as the query target;

[0112] Check if the target cluster contains the minimum data access permission set of the target cluster. If the target cluster does not contain the target cluster, reject the query.

[0113] If the query target is included, the corresponding target content is read from the corresponding storage location of the query target on the personnel configuration blockchain, based on the storage location of the query target on the blockchain, and used as the query data.

[0114] The sensitive information in the target content is decrypted by querying the employee's private key, and the decrypted sensitive information plaintext and non-sensitive information in the target content are then visualized.

[0115] Understandably, if the target content is not to query the employee's own data, the employee's attempt to decrypt the sensitive information using the decryption private key will fail, thus protecting the information security of other employees.

[0116] Example 2

[0117] like Figure 2 As shown, the blockchain-based personnel configuration information secure storage system includes a personnel configuration graph construction module, a personnel configuration blockchain construction module, an employee cluster construction module, and a secure access module; wherein, the various modules are connected to each other electrically.

[0118] The personnel configuration graph construction module collects personnel configuration data, constructs a personnel configuration graph based on the personnel configuration data, and sends the personnel configuration graph to the personnel configuration blockchain construction module, the personnel configuration blockchain construction module, and the secure access module;

[0119] The personnel configuration blockchain construction module generates an encryption public key and a decryption private key for each employee; it divides the personnel configuration graph into sensitive and non-sensitive information; based on the sensitive and non-sensitive information, it uses the employee's encryption public key to encrypt and store the personnel configuration graph in the personnel configuration blockchain; and it sends the personnel configuration blockchain to the secure access module.

[0120] The employee cluster construction module collects employees' historical access data, uses a clustering algorithm based on the personnel configuration graph to divide employees into K employee clusters, and sends the employee clusters to the secure access module.

[0121] The secure access module sets a minimum data access permission set for each employee cluster based on a subset of historical access data contained within each cluster. It collects the identity information of each employee making an inquiry, retrieves the employee cluster to which the inquiring employee belongs based on the identity information, and uses it as the target cluster. It receives the knowledge graph query statement input by the inquiring employee, and obtains the corresponding encrypted data from the personnel configuration blockchain based on the minimum data access permission set of the target cluster and the knowledge graph query statement. It then decrypts the encrypted data using the decryption private key corresponding to the inquiring employee.

[0122] Example 3

[0123] Figure 3 This is a schematic diagram of a computer-readable storage medium structure provided in one embodiment of this application. Figure 3 The diagram illustrates a computer-readable storage medium 200 according to one embodiment of this application. The computer-readable storage medium 200 stores computer-readable instructions. When executed by a processor, the computer-readable instructions can perform the blockchain-based personnel configuration information secure storage method according to an embodiment of this application, as described with reference to the above figures. The computer-readable storage medium 200 includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0124] Furthermore, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, this application provides a non-transitory machine-readable storage medium storing machine-readable instructions that can be executed by a processor to perform instructions corresponding to the method steps provided in this application. When the computer program is executed by a central processing unit (CPU), it performs the functions defined in the method of this application.

[0125] The methods, apparatus, and devices of this application may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the method is for illustrative purposes only, and the steps of the method of this application are not limited to the order specifically described above, unless otherwise specifically stated. Furthermore, in some embodiments, this application may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the method according to this application. Thus, this application also covers recording media storing programs for performing the method according to this application.

[0126] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0127] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0128] The preset parameters or preset thresholds mentioned above are all set by those skilled in the art based on actual conditions or obtained through large-scale data simulation.

[0129] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for securely storing personnel configuration information based on blockchain, characterized in that, Includes the following steps: Step 1: Collect personnel configuration data and construct a personnel configuration map based on the personnel configuration data; Step 2: Generate an encryption public key and a decryption private key for each employee; divide the personnel configuration graph into sensitive and non-sensitive information; based on the sensitive and non-sensitive information, use the employee's encryption public key to encrypt and store the personnel configuration graph in the personnel configuration blockchain; Step 3: Collect employee historical access data. Based on the personnel configuration map, use a clustering algorithm to divide the employee historical access data into K employee clusters; K is the preset number of employee clusters. Step 4: Based on the subset of employee historical access data contained in each employee cluster, set a minimum set of data access permissions for each employee cluster; Step 5: Collect the identity information of each employee being queried, and based on the identity information, retrieve the employee cluster to which the employee being queried belongs, and use it as the target cluster; Step Six: Receive the knowledge graph query statement input by the employee making the inquiry. Based on the minimum data access permission set of the target cluster and the knowledge graph query statement, obtain the corresponding query data from the personnel configuration blockchain, and decrypt the query data using the decryption private key corresponding to the employee making the inquiry. The process of collecting employee historical access data and, based on the personnel configuration map, using a clustering algorithm to divide employees into K employee clusters includes the following steps: Step 21: Collect employee historical access data by tracking and recording each employee's access to the personnel configuration map; Step 22: Construct an employee access matrix based on employee historical access data and personnel configuration map; Step 23: Randomly initialize K cluster centers using the K-Means++ algorithm; Step 24: Traverse each employee in the employee access matrix, calculate the distance between the employee and each cluster center, assign the employee to the employee cluster corresponding to the nearest cluster center, and recalculate the position of the center point of each cluster. Step 25: Repeat step 24 until the employee IDs contained in the employee clusters corresponding to each cluster center no longer change; The method of encrypting and storing the personnel configuration graph in the personnel configuration blockchain based on sensitive and non-sensitive information and using the employee's encrypted public key is as follows: Traverse all sets of conceptual entities, relational entities, and attribute entities in the personnel configuration graph: For sensitive information: Read the corresponding employee's public key and use the public key and the corresponding asymmetric encryption algorithm to encrypt sensitive information; Create a new data block on the personnel configuration blockchain and store the encrypted sensitive information in ciphertext and the plaintext non-sensitive data in the new data block; Each employee's data blocks are organized into an individual data storage area by linking them together. The employee's personnel configuration data type is stored in different blockchain branches. A storage mapping index is created for each employee to record the location of the data in the blockchain corresponding to that employee.

2. The method for securely storing personnel configuration information based on blockchain according to claim 1, characterized in that, The method for collecting personnel configuration data is as follows: Collect personnel configuration data from various existing personnel configuration data types in the personnel configuration information system, and perform data preprocessing on each personnel configuration data to obtain structured personnel configuration data.

3. The method for securely storing personnel configuration information based on blockchain according to claim 2, characterized in that, The process of constructing a personnel configuration map based on personnel configuration data includes the following steps: Step 11: Construct the graph ontology of the personnel configuration graph; Step 12: Use the entity extraction model to extract the set of concept entities of each core concept in the graph ontology, use the relation extraction model to extract the set of relation entities of each relation type in the graph ontology, and use the attribute extraction model to extract the set of attribute entities of each concept entity and relation entity in the graph ontology. Step 13: Based on the set of concept entities, the set of relation entities, and the set of attribute entities, use a knowledge graph representation language to describe the concept entities, relation entities, and their attribute sets, and establish links between the various concept entities and relation entities to form a unified personnel configuration knowledge graph.

4. The method for securely storing personnel configuration information based on blockchain according to claim 3, characterized in that, The method for classifying the personnel configuration map into sensitive and non-sensitive information is as follows: Based on the company's data security policy, identify personnel configuration data types that fall under the sensitive level and designate them as sensitive types. From the graph ontology, data belonging to sensitive types in each entity type and attribute set are selected as the sensitive information ontology; In the personnel configuration graph, the conceptual entities and attribute set entities corresponding to the sensitive information ontology are marked as sensitive information, while the remaining conceptual entities, relational entity sets, and attribute set entity sets in the personnel configuration graph are marked as non-sensitive information.

5. The method for securely storing personnel configuration information based on blockchain according to claim 4, characterized in that, The process of constructing the employee access matrix includes: Obtain a list of all conceptual entities, relational entities, and attribute set entities from the personnel configuration graph, and use it as columns of the employee access matrix; Obtain a list of all employee IDs from the employee's historical access data, and use it as rows in the employee access matrix; The element values ​​of each row and column of the employee access matrix are initially set to 0; Iterate through the employee's historical access data, set the element values ​​corresponding to the concept entity, relation entity, and attribute set entity accessed by each employee ID to 1, and finally construct an M-row N-column 0 / 1 employee access matrix to describe the access relationship between employees and entities; M is the number of employee IDs, and N is the total number of concept entities, relation entities, and attribute set entities.

6. The method for securely storing personnel configuration information based on blockchain according to claim 5, characterized in that, The method for setting a minimum set of data access permissions for each employee cluster based on a subset of employee historical access data contained within each employee cluster is as follows: For each employee cluster, count all concept entities, relation entities, and attribute set entities accessed by all employees within that cluster, forming a minimum data access permission set.

7. The method for securely storing personnel configuration information based on blockchain according to claim 6, characterized in that, The method for receiving the knowledge graph query statement input by the employee, based on the minimum data access permission set of the target cluster and the knowledge graph query statement, to obtain the corresponding encrypted data from the personnel configuration blockchain, and to decrypt the encrypted data using the decryption private key corresponding to the employee is as follows: The query query statement is used to retrieve the concept entity, relation entity, or attribute set entity that needs to be queried as the query target; Check if the target cluster contains the minimum data access permission set of the target cluster. If the target cluster does not contain the target cluster, reject the query. If the query target is included, the corresponding target content is read from the corresponding storage location of the query target on the personnel configuration blockchain, based on the storage location of the query target on the blockchain, and used as the query data; The sensitive information in the target content is decrypted using the employee's private key, and the decrypted plaintext of the sensitive information and the non-sensitive information in the target content are then visualized.

8. A blockchain-based secure storage system for personnel configuration information, used to implement the blockchain-based secure storage method for personnel configuration information as described in any one of claims 1-7, characterized in that, It includes a personnel configuration graph construction module, a personnel configuration blockchain construction module, an employee cluster construction module, and a secure access module; the modules are connected electrically. The personnel configuration graph construction module collects personnel configuration data, constructs a personnel configuration graph based on the personnel configuration data, and sends the personnel configuration graph to the personnel configuration blockchain construction module, the personnel configuration blockchain construction module, and the secure access module; The personnel configuration blockchain construction module generates an encryption public key and a decryption private key for each employee; it divides the personnel configuration graph into sensitive and non-sensitive information; based on the sensitive and non-sensitive information, it uses the employee's encryption public key to encrypt and store the personnel configuration graph in the personnel configuration blockchain; and it sends the personnel configuration blockchain to the secure access module. The employee cluster construction module collects employees' historical access data, uses a clustering algorithm based on the personnel configuration graph to divide employees into K employee clusters, and sends the employee clusters to the secure access module. The secure access module sets a minimum data access permission set for each employee cluster based on a subset of historical access data contained within each cluster. It collects the identity information of each employee making an inquiry, retrieves the employee cluster to which the inquiring employee belongs based on the identity information, and uses it as the target cluster. It receives the knowledge graph query statement input by the inquiring employee, and obtains the corresponding encrypted data from the personnel configuration blockchain based on the minimum data access permission set of the target cluster and the knowledge graph query statement. It then decrypts the encrypted data using the decryption private key corresponding to the inquiring employee.

9. A computer-readable storage medium, characterized in that, It contains erasable and rewritable computer programs; When the computer program is run on a computer device, the computer device executes the blockchain-based personnel configuration information secure storage method according to any one of claims 1-7 in the background.

Images